Security Properties

Set the valid parent hosts that may embed Blueriq using <frame>, <iframe>, <object>, <embed> or <applet>. For more information see Security: Clickjacking protection.

Available since Blueriq 14.4.

Note that Content Security Policy is not supported by Internet Explorer, so this setting will not have an effect on users that still use Internet Explorer.

Boolean

Set the whitelisted protocols in URI attributes.

Example value: 'http,https,mailto'

Set the whitelisted HTML tags.

Example value: 'b,img'

Set the whitelisted attributes allowed on any whitelisted HTML tag.

Example value: 'class,title'

Set the whitelist attributes allowed on a specific whitelisted HTML tag.

Example key: 'blueriq.security.xss-protection.whitelist.allowed-attributes.h1'

Example value: 'class'

Key: string

Value: comma separated string

Key: string

Value: comma separated string

Disallow doctype declaration processing in XML-files.

Protection is enabled when set to: true.

Enable loading external DTDs in XML-files.

Protection is enabled when set to: false.

Enable processing external general entities in XML-files.

Protection is enabled when set to: false.

Enable processing external parameter entities in XML-files.

Protection is enabled when set to: false.

Enable processing of XML Inclusions (XInclude) in XML-files.

Protection is enabled when set to: false.

Enable expansion of entity references in XML-files.

Protection is enabled when set to: false.

Specify the methods that should not be allowed while doing HTTP calls. For more information go to Security: Block HTTP Methods.

Example value: 'head,get,post,options'

This property if true enables the default secured access to the runtime interactions.

Defines the login type used in Blueriq.

If openid-connect is chosen, openid-connect properties have to be defined as well.

One of:

• 'form-login'
• 'openid-connect'
• 'jwt'

Define a whitelist of URLs where the user can be redirected to. If the redirect_uri (for OpenIdConnect login/logout) or the error-redirect (for render document/page and file download) are not in this list, the Runtime will return 400. This list is case sensitive.

If the list is empty, any URL is accepted up to version 14.x. From 15.0 onwards, no URLs are accepted when an empty list is provided.

Spring Resource

The path to the trust store containing the public keys/certificates of external hosts that should be trusted.

This indicates the trust store that is used for the Soap Service Client.

Spring Resource

Turn session fixation on/off. For more information, see Security: Session Fixation protection.

Introduced in versions 14.11, 13.13.18 and 12.13.39.

Enable response headers related to Cross-Origin Resource Sharing.

When disabled, the Same-origin policy implemented in web browsers does not allow scripts with a different origin to call Runtime endpoints. This is the secure default.

blueriq.security.cookie-same-site.enabled

Turn on the same site attribute for the cookies in blueriq.  for more information see: Security: SameSite.

Introduced in version 15.0.

blueriq.security.cookie-same-site.value

Define the value for the same site attribute for the cookies in blueriq. for more information see: Security: SameSite.

Introduced in version 15.0.